The Node.js Project will soon issue a CVE for EOL versions of Node.js such as Node.js 16 — which is still downloaded 11 million times per month.

You can run is-my-node-vulnerable to check if you are using an EOL version of any version with a CVE issued to it.

npx is-my-node-vulnerable

These versions are supported as of this writing:

• Node.js 23 (Current)
• Node.js 22 (LTS)
• Node.js 20 (Maintenance LTS)
• Node.js 18 (Maintenance LTS)

Why issue a CVE? Node.js aims to warn users by issuing a CVE:

• Raise Awareness: Inform users that running EOL versions exposes their applications to potential vulnerabilities.
• Encourage Upgrades: Prompt organizations and developers to update to actively supported Node.js versions.
• Improve Security: Reduce the number of applications running outdated and unsupported versions of Node.js.